Last August, LastPass reported a security breach, saying that no customer information—or passwords—were compromised. Turns out the full story is worse